Responsible Governance

Darfon places strong emphasis on information security and has established an information security governance framework based on international standards. The Company implements the ISO 27001 Information Security Management System (ISMS) and conducts regular audits to strengthen the protection of customer information, intellectual property, and digital assets.

As of October 2025, Darfon had obtained ISO 27001:2022 certification for its operations in Taiwan, China, and Vietnam, covering the Group’s core information security management system and strengthening its capabilities in cyber risk management and incident response.

Darfon attaches great importance to information security. The company has formulated relevant internal information security management operations in accordance with the provisions of Article 9 "Computerized Information System Processing" of "Publicly Offered Companies Establishing Internal Control Systems" to reduce the unknowns caused by the ever-changing information environment. Information security risk threats, basic information security policy controls are as follows:

Information Security Control Measures

①  Internal and external network access must pass firewall/virus wall/intrusion prevention system inspection.

②  All information equipment must be installed with anti-virus/anti-backdoor software.

③  Regularly change user passwords every 3 months and must comply with the complexity principle.

④  To access any system, you need to apply for an account and have permissions to restrict open access. The account will be deleted after resignation.

⑤  Confidential information access, file encryption throughout the process.

⑥  All processes must be electronically signed and approved before they can take effect.

⑦ All end-point (user terminal) information equipment reclaims Admin (administrator) permissions and installs asset management software and endpoints.